Fleet policy and native launch admission

yoke_contracts.fleet_policy owns timing, message limits, retries, broadcast confirmation and surface fallback as product constants. Launch registration has 10 minutes from relay pickup. Organization settings retain membership.auto_join_domain_verified under Membership. New configuration requires a work item naming the person who needs to change that value.

Relay polls lease assigned launches alongside serial control/wake work. An idle machine with no launch-capable surface polls every 5 minutes instead of every minute. A relay that has not probed its surfaces yet, such as a fresh install, keeps the one-minute cadence until it reports what it found. Each serialized native spawn checks current reclaimable memory and swap, with a three-second stagger. macOS uses only /usr/bin/vm_stat, independently of the relay's filtered PATH; Linux reads /proc/meminfo. Admission needs 1 GiB available memory. Linux also needs 512 MiB free swap when swap is enabled. macOS grows swap on demand, so admission has no swap ceiling there. Disabled swap permits launching with sufficient memory. Placement also respects configured machine capacity.

Launch and wake records, including Cursor, name native_memory_headroom_low, native_swap_headroom_low or native_capacity_unreadable when no native starts; the refusal and its skip_reason show the observed and required bytes for available memory and free swap. For low headroom, stop unused processes and retry; for unreadable capacity, restore the OS probe before retrying. Thresholds and refusals come from yoke_contracts.machine_config.native_capacity, using the shared memory-lane constant in machine_capacity.